Yamato Transport Breach Exposes Kuroneko Pay-Later Payment Data

Yamato Transport confirmed a data breach in its Kuroneko Pay-Later service on September 28, 2026, after detecting unauthorized third-party access to payment systems. The company immediately restricted external connections and halted the service at 22:28 JST that day. Investigations later verified that personal and transaction data had been exfiltrated from the deferred-payment platform used by online shoppers.

The breach remained confined to the Kuroneko Pay-Later systems. Standard delivery services such as Takkyubin continued without interruption. Service resumed on October 9, 2026, following verification by external security specialists, with payment deadlines extended by 17 days for affected billing slips.

Scope of Data Exfiltrated in the Yamato Transport Breach

Investigators determined that the attackers obtained buyer information spanning October 2018 to September 2026. Approximately 5.26 million buyer records contained names, addresses, phone numbers, and in some cases email addresses, along with item details including names, quantities, and unit prices. Internal reference numbers for applications, orders, and credit screening were also taken. Credit card numbers, passwords, and outstanding balances were not involved.

Separate sets of records affected delivery recipients and merchants. About 50,000 recipient records from February 2021 onward included names, addresses, phone numbers, and tracking numbers. Roughly 4,100 merchant records listed names and codes. Yamato reported these figures without deduplicating individuals across categories, and no employee names were confirmed as exposed.

• Buyer records: names, addresses, phones, limited emails, purchase details
• Recipient records: names, addresses, phones, waybill numbers
• Merchant records: names and internal codes

As of October 24, 2026, no confirmed misuse of the stolen data has been reported. Yamato has warned customers about possible phishing attempts that reference the breach and advised recipients to delete suspicious messages without clicking links.

Response Measures and Ongoing Security Considerations

Yamato notified Japan's Personal Information Protection Commission on the day of discovery and contacted affected individuals and merchants where contact details allowed. Public notices served as notification for those unreachable by direct means. The company stated it would implement medium- and long-term security improvements, including tighter access controls and enhanced monitoring, based on recommendations from external experts.

The intrusion method has not been disclosed publicly. No evidence has emerged of similar access to other Yamato platforms such as Kuroneko Members. Payment deadlines were extended automatically for slips due on or after September 28, reducing immediate financial pressure on users while the service was offline.

Users concerned about the Yamato Transport breach should monitor accounts for unusual activity and treat any unexpected payment requests with caution. Merchants using the platform received direct outreach where possible. The incident highlights risks associated with fintech features embedded in logistics operations, where buyer and merchant data intersect in a single system.